# Skyelight (npm · @skyelight/mcp)

Give your AI assistant feedback pinned to the exact element, with its code, so it can fix and reply.

- Trust score: 69/100 (medium)
- Change this week: 0
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- remote · `app.skyelight.ai`: 86/100, [markdown](https://verifymcp.io/servers/plastrlab-skyelight-mcp/app.md), [page](https://verifymcp.io/servers/plastrlab-skyelight-mcp/app)
- npm · `@skyelight/mcp`: 69/100 (this document), [markdown](https://verifymcp.io/servers/plastrlab-skyelight-mcp/skyelight-mcp.md), [page](https://verifymcp.io/servers/plastrlab-skyelight-mcp/skyelight-mcp)

## Channel facts

- Registry: `npm`
- Package: `@skyelight/mcp`
- Version: `1.0.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Supply Chain Security**: 100/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - No production dependencies, so there is no dependency health to assess.
- **Provenance & Transparency**: 35/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Licence could not be checked: the licence is shipped as a file inside the package, not declared as a standard (SPDX) licence identifier, so we cannot tell whether it is OSI-approved.
  - Actively maintained (last published 12 days ago).
  - Publishes a security disclosure policy (SECURITY.md).
- **Schema Quality & AI Usability**: 79/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 2898 tokens (~152/item across 19 items; 18 tools + 1 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 97/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 91% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.
  - An AI judge read all 20 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### How do I install the Skyelight MCP server?

Skyelight runs locally as an npm package, launched with npx -y @skyelight/mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add plastrlab-skyelight-mcp -- npx -y @skyelight/mcp
```

### Cursor

```json
{
  "mcpServers": {
    "plastrlab-skyelight-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@skyelight/mcp"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "plastrlab-skyelight-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@skyelight/mcp"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add plastrlab-skyelight-mcp -- npx -y @skyelight/mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "plastrlab-skyelight-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@skyelight/mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add plastrlab-skyelight-mcp --command npx --arg -y --arg @skyelight/mcp
```

### Hermes

```yaml
mcp_servers:
  plastrlab-skyelight-mcp:
    command: "npx"
    args: ["-y", "@skyelight/mcp"]
```

### Netclaw

```json
{
  "McpServers": {
    "plastrlab-skyelight-mcp": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "@skyelight/mcp"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add plastrlab-skyelight-mcp -t stdio -c npx -a -y @skyelight/mcp
```

### Other

```json
{
  "mcpServers": {
    "plastrlab-skyelight-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@skyelight/mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-10-24 (score 69, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-10-23 (score 54)

First indexed and scored.

## MCP tools (18)

### `list_workspaces` (~55 tokens)

List workspaces

Workspaces you can reach, with the role you hold in each, and who you are. Use when you do not know what exists yet, to find which workspace a project belongs to, or to learn your own user id.

### `list_projects` (~63 tokens)

List projects

Projects you can reach, newest activity first, across every workspace unless one is named. Start here when no project is bound — `list_items` needs a project id and this is where one comes from.

Input parameters:

- `workspaceId` (string): Narrow to one workspace. Optional.

### `list_items` (~287 tokens)

List feedback

List feedback items (bugs, ideas, comments) people left on a Skyelight project. Returns a summary of the project plus matching items. Start here to see what is outstanding. An item's hand-off (investigate, plan, fix) is set by the team and binding: on investigate or plan, reply on the thread and change no code.

Input parameters:

- `assignee` (string): A user id, "me" for whoever this connection belongs to, or "none" for unassigned items.
- `limit` (number): Max items (default 50).
- `page` (string): Only items on one page, e.g. "/checkout".
- `projectId` (string): Project to read. Optional when a project is bound or the workspace has only one; otherwise the error lists the projects and their ids.
- `status` (string): Defaults to everything. "deferred" is work someone put off until later — outstanding, but deliberately not now.
- `task` (string): Only items a person handed to an agent with this task (Hand off in the app), or "none" for items with no hand-off. Combine with assignee to find your own. Investigate and plan mean reply on the threa…
- `type` (string): Item type, e.g. "bug", "idea", "feedback".

### `search_items` (~97 tokens)

Search feedback

Find items whose thread mentions some text. Searches replies as well as the original message, so an item someone already diagnosed in a reply still turns up.

Input parameters:

- `limit` (number)
- `projectId` (string): Project to search. Optional when a project is bound or the workspace has only one; otherwise the error lists the projects and their ids.
- `query` (string, required): Text to look for.
- `status` (string)

### `post_update` (~159 tokens)

Post an update

Report back on an item: what you found, what you changed, a link to the PR. Posts as a reply on the thread the feedback was left on, so the person who reported it sees the answer where they asked. Use this when you finish work on an item, and when you get stuck.

Input parameters:

- `body` (string, required): What you found or changed, in plain language for the person who reported it.
- `itemId` (string, required): Item id from list_items.
- `links` (array): Optional links — a PR, a commit, a deploy.
- `mentions` (array): People to notify, by name, email or id from list_members ("me" is you). Write @Name in the body where you mention them.

### `create_item` (~189 tokens)

Create feedback

Open a new thread on a page, as the person whose connection you are using. Only available on a person's own connection — an agent reporting what it found or changed uses post_update on the thread it was working, so the answer lands where the question was asked.

Input parameters:

- `assignee` (string): Who should take it: a name, email or id from list_members, or "me".
- `body` (string, required): What you want to say.
- `mentions` (array): People to notify, by name, email or id from list_members ("me" is you). Write @Name in the body where you mention them.
- `pageTitle` (string)
- `projectId` (string): Optional if a project is bound.
- `selector` (string): CSS selector for the element, if there is one.
- `url` (string, required): Full URL of the page this is about.

### `publish_review_link` (~450 tokens)

Publish a review link

Share something with Skyelight for review, and get a link people can pin feedback on. Two ways:
\- code: one file Skyelight hosts at its own link with the review badge on it. A whole HTML page, or one React component with an export default (Tailwind classes and npm imports work; local imports such as @/components do not). For Claude prototypes, v0 snippets and single pages. Publishing again with the same prototypeId, or the same name in the same project, makes a new version at the same link.
\- url: an app already deployed (a Lovable, v0, Bolt or Vercel project: anything with more than one file). Adds its address to the project's Review Links and returns a script tag to add to the app's <head> (index.html, or the root layout); add it and redeploy. Owners and admins.
Returns the share link and the project link; give both to the person. A hosted link is public to anyone who has it.

Input parameters:

- `code` (string): For Skyelight to host: the complete file, never a summary or an excerpt. Or give url.
- `kind` (string): With code; worked out from it when left out.
- `name` (string): What it is, in a few words. Names the hosted link and, when no project is given, a new project.
- `projectId` (string): Optional: the project to put it in. Left out, a new project is made for it.
- `prototypeId` (string): With code: to publish a new version of a prototype published before.
- `source` (string): With code: where it was made, shown as its logo in Skyelight: "claude", "claude-code", "openai" (ChatGPT), "cursor", "windsurf", "v0", "lovable" or "other". Name yourself.
- `url` (string): Where the app is deployed, e.g. https://my-app.lovable.app. Or give code.
- `workspaceId` (string): When you are in more than one workspace and give no project, from list_workspaces.

### `list_members` (~90 tokens)

List members

The people in a workspace: name, email, role and id. Call it when you are asked to tell, ask or hand something to someone by name, then pass their name or id to assign, or in mentions on create_item or post_update.

Input parameters:

- `projectId` (string): Optional if a project is bound.
- `workspaceId` (string): Instead of a project, from list_workspaces.

### `assign` (~97 tokens)

Assign

Hand an item to a person, who is notified the way an assignment in the app notifies them. Pass null as the assignee to unassign it. Only owners, admins and collaborators can assign; a resolved item has to be reopened first.

Input parameters:

- `assignee` (string|null, required): A name, email or id from list_members, "me", or null to unassign.
- `itemId` (string, required): Item id from list_items.

### `set_status` (~85 tokens)

Set status

Move an item to open, deferred or resolved. Use it to close the loop after you have fixed something and said so — post_update first, so the person who reported it reads what changed, then set_status. "deferred" is for work that is real but not now.

Input parameters:

- `itemId` (string, required): Item id from list_items.
- `status` (string, required)

### `get_item` (~84 tokens)

Get feedback item

Everything needed to work one item: the whole thread in order, the page and URL it is on, the anchor identifying the element the person pointed at, and the pictures — what the page looked like when it was pinned, plus anything people attached — returned as images you can look at rather than links you cannot.

Input parameters:

- `itemId` (string, required): Item id from list_items.

### `project_review` (~170 tokens)

Review project

Everything needed to write an accurate project review or hand-off document: the shape of the work, every resolved thread and how it ended, what was deferred and why, what is still open, and the longest conversations quoted in full, which is where decisions were made. Every entry carries its item id, so each claim in your document can be traced back to its thread. Quote; do not invent outcomes the threads do not state.

Input parameters:

- `offset` (number): With section: where to start, from the previous result's 'more' line.
- `projectId` (string): Project to review. Optional if a project is bound.
- `section` (string): Omit for the overview (all counts, first rows of each section). Name one to read it in full, a page at a time.

### `whats_new` (~126 tokens)

What's new

What changed on a project since you last looked: new threads, new replies grouped by thread, what was resolved or deferred, and what was assigned to you or mentioned you. Call it at the start of a session. Without `since` it reads from your bookmark and moves it forward; with `since` it reads that window and leaves the bookmark alone.

Input parameters:

- `projectId` (string): Optional if a project is bound.
- `since` (string): Optional. A date or time ("2026-09-01", an ISO time) to read from instead of your bookmark.

### `find_by_source` (~166 tokens)

Find feedback by source file

Feedback by the code that rendered it, from the file and line the Skyelight build plugin stamps on each element. Pass a file (a path or just its name) or a component to see every thread about it before you edit it; pass neither to get the hot spots, every stamped file ranked by outstanding feedback.

Input parameters:

- `component` (string): A component name, e.g. "PricingTable".
- `file` (string): A source path or file name, e.g. "src/components/PricingTable.tsx" or "PricingTable.tsx".
- `limit` (number)
- `line` (number): Optional. Threads nearest this line come first.
- `projectId` (string): Optional if a project is bound.
- `status` (string)

### `find_similar` (~205 tokens)

Find similar feedback

Has this already been reported? Pass the text you are about to report (and the page, if you know it) before create_item, or an itemId to find what an existing thread duplicates. Returns likely matches with why each matched: shared words, same page, same element, same source file. If two are the same problem, merge_items folds one into the other.

Input parameters:

- `includeResolved` (boolean): Default true: a resolved match may mean it came back. false to skip them.
- `itemId` (string): Instead of text: find duplicates of this item.
- `limit` (number): Max matches (default 5).
- `page` (string): Optional. A page path or URL, e.g. "/checkout".
- `projectId` (string): Optional if a project is bound or itemId is given.
- `selector` (string): Optional. CSS selector of the element.
- `text` (string): What someone is about to report.

### `merge_items` (~98 tokens)

Merge duplicates

Fold duplicate items into one, the way merging works in the app: the duplicates leave the list and count as extra reports on the item they were merged into. Use it only when find_similar and the threads themselves show they are the same problem. Owners, admins and collaborators can merge.

Input parameters:

- `duplicateIds` (array, required): Items that report the same problem.
- `itemId` (string, required): The item to keep. The others fold into it.

### `decision_log` (~149 tokens)

Decision log

The decisions a project made in its threads, quoted: every thread resolved or deferred after a discussion, with the conversation, plus types people corrected and where outcomes keep recurring. Also returns the project's existing rules, so you can tell what is new. Use it to write a decision log, or to find rules worth keeping with save_rule.

Input parameters:

- `limit` (number): Decisions per page (default 15, at most 30).
- `offset` (number): Where to start, from the previous result's 'more' line.
- `projectId` (string): Optional if a project is bound.
- `since` (string): Optional. Only decisions after this date ("2026-09-01").

### `save_rule` (~128 tokens)

Save a rule

Keep a rule the team agreed on ("sentence case in every button", "the brand gray stays, do not raise contrast bugs on it") in the project's context, under Rules learned. The classifier reads that context, and every agent reads it through decision_log, so it shapes future threads. Cite the threads it came from. Workspace owners and admins only; confirm with the person before saving.

Input parameters:

- `projectId` (string): Optional if a project is bound.
- `rule` (string, required): The rule, in one plain sentence.
- `sourceItemIds` (array): Items the rule came from.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/plastrlab-skyelight-mcp/skyelight-mcp#diagnostics

## Score history

- 2026-11-05: 69
- 2026-11-04: 69
- 2026-11-03: 69
- 2026-11-02: 69
- 2026-11-01: 69
- 2026-10-31: 69
- 2026-10-30: 69
- 2026-10-29: 69
- 2026-10-28: 69
- 2026-10-27: 69
- 2026-10-26: 69
- 2026-10-25: 69
- 2026-10-24: 69
- 2026-10-23: 54

## Common questions

### What is the Skyelight MCP server?

Skyelight is an MCP server listed in the public MCP registry as io.github.plastrlab/skyelight-mcp. Give your AI assistant feedback pinned to the exact element, with its code, so it can fix and reply. This page covers its npm package (@skyelight/mcp).

### Is the Skyelight MCP server safe to use?

Skyelight scores 69 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Skyelight MCP server expose?

Skyelight exposes 18 tools: list_workspaces, list_projects, list_items, search_items, post_update, and 13 more. Their descriptions and schemas cost roughly 2,698 tokens of context every time the server is loaded.

### Is the Skyelight MCP server still maintained?

Skyelight is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- npm package: https://www.npmjs.com/package/@skyelight/mcp
- Socket report: https://socket.dev/npm/package/@skyelight/mcp
- Repository: https://github.com/plastrlab/skyelight-mcp
- Website: https://skyelight.ai/docs/mcp?ref=mcp-registry
- Changelog RSS feed: https://verifymcp.io/servers/plastrlab-skyelight-mcp/skyelight-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/plastrlab-skyelight-mcp/skyelight-mcp.json
- HTML version of this page: https://verifymcp.io/servers/plastrlab-skyelight-mcp/skyelight-mcp